Don't they, really? I was under the impression that they do implement OS-level sandboxing and the ban on JIT/arbitrary execute is another level of security.